@sema-agent/core 7.0.1 → 7.1.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 7.1.0 — 2026-09-01
+
+### BREAKING (timing) — design/384 slice 1 (#513): turn interrupts reach the ask waiting side
+- **`resolveAsk` no longer waits for the approver to settle once the abort signal fires.** The onAsk await is raced against the composed `AbortSignal.any([run, call])`; the wait settles as the abort-family deny on its own. The prior guarantee "no return before onAsk settles" is REMOVED. Detached discipline: the still-pending approver promise is swallow-guarded; a late APPROVE becomes the `task.late_approval` engine notice; a late REJECT reaches `onError(phase:"hook")` — disclosed, never silent. This also closes the pre-existing run-abort deaf-approver exposure (a walltime/cancel end can no longer be held open by an approver ignoring its signal).
+- **Signal thread (additive seats)**: the loop's turn-scoped signal rides the `tool_call` hook event as an optional `signal` seat; `ToolGateInput.callSignal` (optional) hands it to the three synchronous wait seats (`adjudicate`/`resolveAsk`/`resolveContentAsk`) as a new optional trailing argument — same-arity guarantee when absent (conditional invocation, no explicit trailing `undefined`).
+- **`ENGINE_NOTICE_CODES` closed-set +2** (downstream full-set pins go red): `task.halt_unconsumed` (halt verb answered while the run's ending was already owned by its own abort — nothing cut, `haltedByUser` unsigned, this notice is the halt's only trace) and `task.late_approval` (the detached approver's late yes ran nothing; NON-CONSUMPTION semantics — the engine claims neither who decided nor which came first). Both audience `user`.
+- **`task_aborted` widened by DEFINITION, zero closed-set additions**: the deny resolution now names the run's OR turn's abort signal; the deny message widens to `approval aborted for X (run or turn interrupted)` at all four family sites (probes pinning the old `(task ended)` bytes re-pinned).
+- **Ledger narrowing (named)**: the humanReview gates ledger stops booking abort-family denies (`task_aborted` joins the `approverUnavailable` skip — interrupts are not denials; also covers the pre-existing run-abort booking distortion).
+- **steer `priority:"now"` revokes a pending card and the run continues** (CC-aligned; same seat as `interruptTurn`, pinned e2e).
+
+### Added
+- **Terminal API failure now persists in the transcript** (#506㋐, CC 2.1.250 re-anchor): the harness mints a SEPARATE assistant record (reserved `<synthetic>` model sentinel + `isApiErrorMessage` + one bounded `API Error:` text block ≤2000 chars, `apiErrorStatus`/`requestId` twins, honest `"error"` stop + `usageMissing` — deliberately NOT copying CC's lying `stop_sequence`/zero-usage fields). `convertToLlm` drops every such record from every request view (the invalid-sequence class stays closed), with the exclusion carried at four further seats: auto-mode classifier window, prompt-suggestions grounding tail, compaction cut points, session derived-model tracking. ABORT arm untouched.
+- **`BrainStatus.errorStatus`** (#506㋑): the HTTP status that named a retry's failure now rides the status channel in `api_retry` context (single `namesTheFailure` predicate governs both this seat and `apiErrorStatus`; 0-sentinel and 2xx never publish). WIRE EXTENSION — server/cli consumption named in the ship post.
+
+### Fixed
+- **#512 model-vocabulary batch** (six items): run_workflow card stops teaching a tier-word claim false on tiers-configured deployments (real two-part gate = allowlist ∩ catalog); `parseModelMention` JSDoc recipe corrected to the EXPANDED table; four prototype-chain reads own-gated (live leak: `resolveModelDisplayLabel` returned Object.prototype functions for "toString" onto `agent_start.model`; `__proto__` writes now `Object.defineProperty` own data properties — a codex-caught setter regression); `suggestNextPrompts` bare catch now announces through `onError(phase:"suggestions")` on an explicit unresolvable `role`; roster/durable-registry `model` re-documented as the RECORD KEY; `agent_end.modelResolved` added to the WorkflowEvent union (additive — emitter always wrote it).
+- **`scripts/verify-debts.mjs` two-evidence gate told the truth** (ledger-audit A-03): CLOSED rows now require two DISTINCT addressable coordinates; the old gate passed on a single commit OR post number.
+
+### Docs
+- Self-scan doc-rot batch (33 findings triaged, 13 confirmed + extensions): every rotted `file.ts:NNN` cross-reference in src re-spelled by symbol (line-anchor ratchet banks the cleanup); six orphaned JSDoc blocks reattached to their symbols (incl. the public `Runner` class and `expandTiers`); the stale `agent-harness` abort-clears-queues contract sentence corrected to the #389 truth; release-docs gate register drift fixed in seven places; REVIEW-BACKLOG stale status cells refreshed against the tree.
+
+
+## 7.0.2 — 2026-08-30
+
+### Added
+- **`MemoryEngine.sessionMemoryStatus(sessionId)`** (#511①, design/383 §S-7 — the signed-design read face missed at build): `{captureOptedOut?, committedCount?, foldedCount?, optOutSource?, lastCaptureAt?}`. Every key optional — absence means that fact's source was unreadable, never a coined false/0 stand-in; a store fault answers `optOutSource:"fault"` with `captureOptedOut` ABSENT (the indeterminate axis projected); `foldedCount` counts evidence-only input rows over the full product blocks; the face never throws. New exported type `SessionMemoryStatus` (export surface 1841→1842). Server projects the wire endpoint as a pure derivation ([5786]).
+- **`SessionCaptureRecordStore` dual form** (#511②): the three legs widen to `T | Promise<T>` — a SQL/async backend plugs in with Promise signatures while every existing sync implementation compiles untouched (the additive mechanical proof). The dual form propagates: sync deployments stay sync-transparent end to end; the sync-facing public seats (`MemoryEngineSession.captureOptOut.*`, `ToolExecuteContext.memoryCaptureOptedOut/…Indeterminate`, `parentMemoryCaptureState`) go dual with the await law documented — per-leg failure mapping preserved (mark rejection ⇒ unpersisted, read rejection ⇒ the indeterminate fault axis).
+- **`best` model alias** (#511③, CC 250 $L parity): with `RunnerDeps.tiers` configured, `"best"` resolves to the first DIRECTLY bound tier walking `ultra→max→pro→flash→lite` from the head ("best available", deliberately not a fixed alias-table row). Explicit spellings win over the dynamic walk: a deployment catalog key named `best`, or an explicit `tiers.best` binding. No tiers ⇒ the word stays an unknown ref (refused, never coined).
+
+### Changed — narrowing (named)
+- **Agent tool `model` argument: non-string values on the schema-外 direct-call lane refuse typed** (#511④, test [5781] codex observation): a number/array/boolean/garbage-object now refuses `model.invalid` (closed-set ADDITION beside `model.empty`/`model.unknown` — downstream pinning the details.error set gains a row) instead of crashing or silently no-oping; a legal Model-shape object (string id+api) passes through as the per-call model; strings keep every existing arm byte-identical.
+- **`modelNote` fork-ignored and roster-less arms defuse the model-authored word** (#511⑤, census P2): both arms now run the same `inlineUntrusted` fold (newline fold + fence/envelope-tag neutralization + 80 cap) the family's other three arms already ran — a hostile `model` word can no longer carry raw newlines or fence sentinels into a top-level report line. Clean short words render byte-identical.
+
 ## 7.0.1 — 2026-08-30
 
 ### Added

package/dist/agents/repair-loop.d.ts

@@ -13,7 +13,7 @@ import { type OracleIsolationVerdict } from "../core/oracle-isolation.js";
  * `oracleIsolation` boundary that this slice deliberately does not build — SAFE-tier escalates to a human
  * (`needs_human_oracle`) or surfaces a candidate, but never clears its own work.
  *
- * Like {@link verifyCompleted}, this is a **thin composition** over `runner.runTask` (verify.ts:18-21 posture)
+ * Like {@link verifyCompleted}, this is a **thin composition** over `runner.runTask` (verify.ts's DEPLOYMENT POSTURE section)
  * — it adds no Runner-core surface, touches no vendored code, and is called by a leader/profile (the sibling
  * of {@link runWithVerification}). The oracle internals (which gate/judge/property-harness to compose) live
  * in the PROFILE-injected {@link RepairOracle} closure; core only fixes the {@link OracleResult} shape and the
@@ -75,12 +75,13 @@ export interface OracleResult {
 }
 /**
  * The PROFILE-injected oracle (§1 裁决①). The profile composes the actual grading inside this closure —
- * `runExecGate(graderEnv, steps)` (exec-gate.ts:185, env is the FIRST param = L2 provenance bound to the
- * grader) → `verifyCompleted` (verify.ts:212, the read-only L3 judge) → `checkInvariants`
- * (property-harness.ts:217, explore-only) — and maps the composite to an {@link OracleResult}. Core never
+ * `runExecGate(graderEnv, steps)` (core/exec-gate.ts, env is the FIRST param = L2 provenance bound to the
+ * grader) → `verifyCompleted` (agents/verify.ts, the read-only L3 judge) → `checkInvariants`
+ * (core/property-harness.ts, explore-only) — and maps the composite to an {@link OracleResult}. Core never
  * composes these internals (so the oracle type can't grow a long discriminated union); it only fixes the
  * `OracleResult` shape and the read-only/identity contract. `graderEnv` is the isolated grader env; `evidence`
- * is the diff/results to judge (recompute it from the post-resume working tree on a resume — verify.ts:328 BUG5).
+ * is the diff/results to judge (recompute it from the post-resume working tree on a resume — threat BUG5, the
+ * same freshness duty verify.ts states on its own `evidence` config field).
  */
 export type RepairOracle = (graderEnv: ExecutionEnv, evidence: string | undefined) => Promise<OracleResult>;
 /**
@@ -166,12 +167,12 @@ export interface RepairLoopConfig {
      */
     resumeBundle?: RepairBundle;
     /**
-     * Stop the loop once cumulative cost reaches this (verify.ts:278 backstop). HRD-AGO-6 — "cumulative" is
+     * Stop the loop once cumulative cost reaches this (verify.ts's `costCeilingMicroUsd` backstop). HRD-AGO-6 — "cumulative" is
      * every leg the loop pays for: each attempt's own + nested `runTask` cost PLUS each verdict's
      * {@link OracleResult.costMicroUsd} (an LLM-judge oracle is charged per attempt too).
      */
     costCeilingMicroUsd?: number;
-    /** Overall ACTIVE wall-clock ceiling for the whole loop (verify.ts:277 backstop). F1: both ceilings
+    /** Overall ACTIVE wall-clock ceiling for the whole loop (verify.ts's `totalTimeoutMs` backstop). F1: both ceilings
      *  are CROSS-RESUME — the carried {@link RepairBundle.spentMicroUsd}/{@link RepairBundle.activeElapsedMs}
      *  re-seed the accounts, so a durable resume continues the budget rather than restarting it. */
     totalTimeoutMs?: number;

package/dist/agents/roster-store.d.ts

@@ -12,8 +12,13 @@ export interface RosterEntry {
      *  key; equals the spawner's session at depth 1). Stored verbatim; no predicate arm consumes it
      *  yet (enumeration/recovery is the reader). */
     rootSessionId?: string;
-    /** design/151 S3b — the RESOLVED model id at spawn (revival lookup key; display/model-routing
-     *  hints only, never a serialized spec). */
+    /** design/151 S3b — the model RECORD KEY at spawn (revival lookup key; display/model-routing hints
+     *  only, never a serialized spec). NOT the resolved model id: a spawn that named a model in WORDS
+     *  records the caller's spelling VERBATIM (a catalog key, tier word or CC alias), because a revival
+     *  re-resolves this value against the catalog in force at WAKE time and a resolved id would only
+     *  ever resolve again on deployments whose catalog keys happen to equal model ids. A spawn that
+     *  carried a Model OBJECT (definition/tool-level/inherited ref) records that object's id, which on
+     *  such a deployment is not a catalog key and degrades softly on the revival lane. */
     model?: string;
     /** Ruled 2026-08-05: the spawn requested a model word that did not bind — the row runs on its
      *  inherited default. Closed set, single member today; absent = bound normally (or no word). */

package/dist/agents/subagent.js

@@ -1590,6 +1590,19 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     };
                 }
             }
+            const modelObjectForm = typeof a.model === "object" &&
+                a.model !== null &&
+                !Array.isArray(a.model) &&
+                typeof a.model.id === "string" &&
+                typeof a.model.api === "string";
+            if (a.model !== undefined && typeof a.model !== "string" && !modelObjectForm) {
+                const typeDesc = Array.isArray(a.model) ? "an array" : a.model === null ? "null" : typeof a.model === "object" ? "an object" : `a ${typeof a.model}`;
+                return {
+                    isError: true,
+                    content: `Sub-agent not started: \`model\` must be a model name (string) from this deployment's catalog — got ${typeDesc}. Omit the parameter to run the agent type's own model.`,
+                    details: { error: "model.invalid" },
+                };
+            }
             if (typeof a.model === "string" && a.model.trim() === "" && !wantsFork && reviveClaim === undefined) {
                 return {
                     isError: true,
@@ -1602,6 +1615,14 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             let modelNote;
             const judgedModels = activeModels();
             const rosterKeys = judgedModels !== undefined ? Object.keys(judgedModels) : [];
+            if (modelObjectForm) {
+                if (wantsFork) {
+                    modelNote = `note: model "${inlineUntrusted(a.model.id, 80)}" was ignored — a fork always runs on the caller's model.`;
+                }
+                else {
+                    perCallModel = a.model;
+                }
+            }
             if (typeof a.model === "string" && requestedModel === undefined) {
                 modelNote = wantsFork
                     ? `note: model "" was ignored — a fork always runs on the caller's model.`
@@ -1609,10 +1630,10 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             }
             else if (requestedModel !== undefined) {
                 if (wantsFork) {
-                    modelNote = `note: model "${requestedModel}" was ignored — a fork always runs on the caller's model.`;
+                    modelNote = `note: model "${inlineUntrusted(requestedModel, 80)}" was ignored — a fork always runs on the caller's model.`;
                 }
                 else if (rosterKeys.length === 0) {
-                    modelNote = `note: model "${requestedModel}" was NOT applied — this delegation tool has no model roster configured; the sub-agent ran on its default (inherited) model.`;
+                    modelNote = `note: model "${inlineUntrusted(requestedModel, 80)}" was NOT applied — this delegation tool has no model roster configured; the sub-agent ran on its default (inherited) model.`;
                 }
                 else {
                     try {
@@ -1783,7 +1804,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     }
                 })()
                 : childModel?.id;
-            const rowModelKey = perCallModel !== undefined ? requestedModel : typeof childModel === "string" ? childModel : childModel?.id;
+            const rowModelKey = perCallModel !== undefined ? requestedModel ?? perCallModel.id : typeof childModel === "string" ? childModel : childModel?.id;
             const childSystemPrompt = def?.systemPrompt ?? opts.systemPrompt;
             const childDefaultPersona = childSystemPrompt === undefined && !wantsFork ? SUBAGENT_PROMPT : undefined;
             const defMaxTurns = typeof def?.maxTurns === "number" && Number.isFinite(def.maxTurns) && def.maxTurns > 0 ? def.maxTurns : undefined;
@@ -2027,6 +2048,9 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             const provenanceRequest = ctx.delegationProvenanceForChildren?.();
             const childProvenanceRef = provenanceRequest !== undefined ? { current: newDelegationProvenanceAggregate() } : undefined;
             const childAttestation = (status) => childProvenanceRef !== undefined ? reduceDelegationAttestation(childProvenanceRef.current, { completed: status === "completed" }) : undefined;
+            const liveCaptureFloor = reviveClaim === undefined
+                ? { optedOut: (await ctx.memoryCaptureOptedOut) === true, indeterminate: (await ctx.memoryCaptureIndeterminate) === true }
+                : undefined;
             const childInternals = {
                 ...(inheritedManifestScope ? { inheritedManifestScope } : {}),
                 ...(childProvenanceRef !== undefined && provenanceRequest !== undefined ? { delegationProvenance: { ref: childProvenanceRef, contentSafety: provenanceRequest } } : {}),
@@ -2045,8 +2069,8 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 ...(ctx.interactionPosture !== undefined ? { parentInteractionPosture: ctx.interactionPosture } : {}),
                 ...(reviveClaim === undefined
                     ? {
-                        ...(ctx.memoryCaptureOptedOut === true ? { memoryCaptureFloor: true } : {}),
-                        ...(ctx.memoryCaptureOptedOut !== true && ctx.memoryCaptureIndeterminate === true ? { memoryCaptureFloorIndeterminate: true } : {}),
+                        ...(liveCaptureFloor?.optedOut === true ? { memoryCaptureFloor: true } : {}),
+                        ...(liveCaptureFloor?.optedOut !== true && liveCaptureFloor?.indeterminate === true ? { memoryCaptureFloorIndeterminate: true } : {}),
                         ...(ctx.memoryCaptureControlDir !== undefined ? { memoryCaptureQueryDir: ctx.memoryCaptureControlDir } : {}),
                         ...(ctx.memoryCaptureAncestors !== undefined ? { memoryCaptureAncestors: ctx.memoryCaptureAncestors } : {}),
                     }

package/dist/brain/errors.d.ts

@@ -82,6 +82,24 @@ export declare function readProviderRequestId(res: {
         get?: (name: string) => string | null;
     };
 } | undefined): string | undefined;
+/**
+ * Does this HTTP status NAME the failure it is being attached to? The one predicate governing every
+ * seat on which this engine publishes a provider status — the terminal assistant frame's
+ * `apiErrorStatus` and the retry-wait status frame's `errorStatus` (#506 ㋑). One helper on purpose:
+ * both seats promise the same three-state discipline, and two copies of the rule would drift.
+ *
+ * Two distinct shapes are refused, and both are reachable:
+ *  · The engine's "no status" SENTINEL, 0 — the terminal HTTP throw carries `r?.status ?? 0` when a
+ *    transport hands back neither a response nor a throw. Publishing it would be absence rendered as a
+ *    number a consumer may format, which is worse than silence.
+ *  · A SUCCESS status. The connect loop only streams a response that is `ok` AND has a body, so an
+ *    `ok` response with a NULL body (an empty 200 from a proxy, a 204) reaches the terminal throw
+ *    carrying 200 — and a provider's own `x-should-retry` verdict can send that same 2xx into a RETRY
+ *    wait. The boundary really did fail, but the status is not what failed, and a consumer routing or
+ *    rendering by a 2xx is exactly the misreading these seats exist to prevent.
+ * Stalls, connect failures and in-band error frames inside a 200 leave the seat absent by the same rule.
+ */
+export declare function namesTheFailure(status: number | undefined): status is number;
 /** Map an HTTP status to an error class. 401/403 = auth (don't retry); 429 = rate limit; 5xx = server. */
 export declare function classifyHttp(status: number): BrainErrorCode;
 /** Lift the machine-readable code back out of a `[code] …` prefixed `errorMessage` (the single shared

package/dist/brain/errors.js

@@ -45,6 +45,9 @@ export function readProviderRequestId(res) {
     }
     return undefined;
 }
+export function namesTheFailure(status) {
+    return status !== undefined && status >= 100 && !(status >= 200 && status < 300);
+}
 export function classifyHttp(status) {
     if (status === 401 || status === 403)
         return "auth";

package/dist/brain/stream-engine.js

@@ -1,6 +1,6 @@
 import { createAssistantMessageEventStream, } from "../internal/llm.js";
 import { FLOOR_OUTPUT_TOKENS, parseContextOverflow, planOutputCapAdjustment } from "./context-overflow.js";
-import { BrainError, classifyConnectFailure, classifyHttp, describeNetworkError, readProviderRequestId } from "./errors.js";
+import { BrainError, classifyConnectFailure, classifyHttp, describeNetworkError, namesTheFailure, readProviderRequestId } from "./errors.js";
 import { classifyInputTooLong } from "./input-too-long.js";
 import { FAST_MAX_BACKOFF_MS, providerWaitHint, retryBackoffMs } from "./retry.js";
 import { emitBrainStatus, emitBrainTelemetry } from "./status-sink.js";
@@ -267,9 +267,8 @@ export function runStreamingBrain(args) {
                 errorMsg.inputTooLongRuledOut = true;
             if (err.apiError === true) {
                 errorMsg.isApiErrorMessage = true;
-                const st = err.status;
-                if (st !== undefined && st >= 100 && !(st >= 200 && st < 300))
-                    errorMsg.apiErrorStatus = st;
+                if (namesTheFailure(err.status))
+                    errorMsg.apiErrorStatus = err.status;
                 if (requestIdSeen !== undefined)
                     errorMsg.requestId = requestIdSeen;
             }
@@ -376,6 +375,7 @@ export function runStreamingBrain(args) {
                                         attempt: attempt + 1,
                                         maxRetries,
                                         errClass: "output_cap",
+                                        ...(namesTheFailure(r?.status) ? { errorStatus: r.status } : {}),
                                     });
                                     continue;
                                 }
@@ -428,6 +428,7 @@ export function runStreamingBrain(args) {
                         discardResponseBody(r);
                         cc.abort();
                         cc.dispose();
+                        const retryStatus = namesTheFailure(r?.status) ? r.status : undefined;
                         await sleepAnnouncingRetry(delayMs, signal, (remainingMs) => ({
                             phase: statusPhase,
                             detail: statusPhase === "rate_limited"
@@ -440,6 +441,7 @@ export function runStreamingBrain(args) {
                             attempt: attempt + 1,
                             maxRetries: laneMaxRetries,
                             errClass,
+                            ...(retryStatus !== undefined ? { errorStatus: retryStatus } : {}),
                         }));
                         continue;
                     }

package/dist/core/context-edit.d.ts

@@ -257,6 +257,9 @@ export interface ContextEditOptions {
  * append-only sessions cannot be rewritten. Dropping the junk from the REQUEST VIEW restores a legal
  * transcript (TR3 rejoins its batch). Deterministic ⇒ byte-stable per request ⇒ prefix-cache safe.
  * New sessions never contain these (the loop exits cleanly on abort; the harness skips persisting them).
+ * #506 ㋐ did NOT re-open this class: the API-failure record the harness now writes carries `API Error: …`
+ * TEXT, so it is not an empty failure assistant and this heal correctly leaves it alone. That record is
+ * excluded one layer later, at `convertToLlm`, by its own three-key identity (`isSyntheticApiErrorMessage`).
  */
 export declare function dropEmptyFailureAssistants(messages: AgentMessage[]): AgentMessage[];
 /**

package/dist/core/governance-codes.d.ts

@@ -103,7 +103,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -124,6 +124,8 @@ export const ENGINE_NOTICE_CODES = [
     "task.user_followup_undrained",
     "steering.parked_input_blocked",
     "task.turn_interrupted",
+    "task.halt_unconsumed",
+    "task.late_approval",
     "memory.capture_opted_out",
     "memory.capture_optout_unpersisted",
     "tool_result.offload_put_failed",
@@ -139,6 +141,8 @@ const NOTICE_AUDIENCE_TABLE = {
     "task.user_followup_undrained": "user",
     "task.turn_interrupted": "user",
     "steering.parked_input_blocked": "user",
+    "task.halt_unconsumed": "user",
+    "task.late_approval": "user",
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
     "memory.consolidation_withheld": "user",

package/dist/core/hooks.d.ts

@@ -1169,7 +1169,10 @@ export declare function normalizePersistedRuleHit(hit: PersistedRuleAnswer): {
     unreadable?: true;
     coverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
 };
-/** Inputs to the two-phase tool gate. `adjudicate`/`resolveAsk` are pre-bound to the task abort signal. */
+/** Inputs to the two-phase tool gate. `adjudicate`/`resolveAsk` are pre-bound to the task abort
+ *  signal; when the caller also supplies {@link ToolGateInput.callSignal}, the Runner's closures
+ *  additionally bind their waits to that per-call signal (`AbortSignal.any` of the two), so a turn
+ *  interrupt releases a pending ask instead of leaving it hanging on the run's lifetime alone. */
 export interface ToolGateInput {
     /** RB-473 batch 2b — bounded disclosure for a HOST callback that throws inside this gate call's
      *  isolation scope (onHookError itself, the deny observer, the durable-park observer). The runner
@@ -1214,13 +1217,28 @@ export interface ToolGateInput {
      *  builds ({@link HookEnvCapabilities}). Built ONCE per task by the runner (after the env is minted) and
      *  passed through unchanged; omitted when the deployment wired no execution environment. */
     hookEnv?: HookEnvCapabilities;
-    /** The combined tool-policy check (abort-bound), or undefined when no policy is wired (→ allow). */
-    adjudicate?: (req: ToolCallRequest) => Promise<PermissionResult>;
+    /**
+     * design/384 slice 1 — the PER-CALL abort signal, carried in from the `tool_call` hook event's
+     * own `signal` seat (the loop's turn-scoped controller; the run abort is composed into it). The
+     * gate itself never awaits on it — it hands the signal verbatim to the three synchronous-wait
+     * seats below (`adjudicate`, `resolveAsk`, `resolveContentAsk`) as their optional trailing
+     * argument, and the Runner's closures compose it with the run signal so a turn interrupt (bare
+     * halt / steer-now) releases the wait. Absent (a host driving the gate directly, or an unthreaded
+     * emit) ⇒ every seat is invoked exactly as before — same arity, no trailing `undefined` (the
+     * threading is a conditional invocation) — and waits stay bound to the run signal alone: the
+     * historical shape, byte-identical.
+     */
+    callSignal?: AbortSignal;
+    /** The combined tool-policy check (abort-bound), or undefined when no policy is wired (→ allow).
+     *  The optional trailing `callSignal` (design/384) is {@link ToolGateInput.callSignal}, passed
+     *  through verbatim; an implementation that ignores it keeps the run-level binding. */
+    adjudicate?: (req: ToolCallRequest, callSignal?: AbortSignal) => Promise<PermissionResult>;
     /** Resolve an `ask` to allow/deny via `onAsk` (abort-bound). Required iff a decision can be `ask`.
      *  G1 three-value: the result may carry `approverUnavailable` — the live approver affirmed no
      *  operator is reachable for THIS ask; the gate then re-routes onto the durable park leg (below),
-     *  keeping the carried fail-closed deny when no park is armed. */
-    resolveAsk: (decision: PermissionResult, req: ToolCallRequest) => Promise<ResolvedAsk>;
+     *  keeping the carried fail-closed deny when no park is armed. The optional trailing `callSignal`
+     *  (design/384) is {@link ToolGateInput.callSignal}, passed through verbatim. */
+    resolveAsk: (decision: PermissionResult, req: ToolCallRequest, callSignal?: AbortSignal) => Promise<ResolvedAsk>;
     /**
      * design/45: route a policy `ask` to a **durable suspension** instead of the synchronous `resolveAsk`
      * (onAsk) path. Called in the `ask` branch with the FINAL post-hook args; if it returns a suspend
@@ -1309,8 +1327,10 @@ export interface ToolGateInput {
      * from "nobody home" — the two have opposite re-routing rules). Passed UNCONDITIONALLY by the runner,
      * including on runs with no live face: it then answers `unavailable` without contacting anything, which
      * is exactly the pre-174 park/refusal behavior. Absent entirely ⇒ the pre-174 path verbatim.
+     * The optional trailing `callSignal` (design/384) is {@link ToolGateInput.callSignal}, passed
+     * through verbatim; an implementation that ignores it keeps the run-level binding.
      */
-    resolveContentAsk?: (req: ToolCallRequest) => Promise<ContentAskOutcome>;
+    resolveContentAsk?: (req: ToolCallRequest, callSignal?: AbortSignal) => Promise<ContentAskOutcome>;
     /**
      * design/70: the called tool is egress-marked (`ToolSpec.egress` — an external write: open a PR,
      * push, send). The gate tightens a surviving `allow` to `ask` so an egress tool is NEVER

package/dist/core/hooks.js

@@ -426,6 +426,7 @@ export function persistedRuleMandateOf(marks) {
 export async function runToolGate(input) {
     const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
     const { toolCallId, toolName } = event;
+    const callSignal = input.callSignal;
     const hookCtx = (seatSignal) => ({
         toolCallId,
         toolName,
@@ -506,7 +507,7 @@ export async function runToolGate(input) {
         }
     }
     const req = { toolName, args: currentInput, toolCallId };
-    let decision = adjudicate ? await adjudicate(req) : { action: "allow" };
+    let decision = adjudicate ? await (callSignal !== undefined ? adjudicate(req, callSignal) : adjudicate(req)) : { action: "allow" };
     let denySource = "policy";
     let policyRewrite;
     if ((decision.action === "allow" || decision.action === "ask") && decision.updatedInput !== undefined) {
@@ -867,7 +868,7 @@ export async function runToolGate(input) {
             }
         }
         if (decision.action === "ask" && req.toolName === ASK_USER_QUESTION_TOOL_NAME) {
-            const outcome = input.resolveContentAsk !== undefined ? await input.resolveContentAsk(req) : { kind: "unavailable", parkDeclined: false };
+            const outcome = input.resolveContentAsk !== undefined ? await (callSignal !== undefined ? input.resolveContentAsk(req, callSignal) : input.resolveContentAsk(req)) : { kind: "unavailable", parkDeclined: false };
             if (outcome.kind === "answered") {
                 decision = { action: "allow", updatedInput: outcome.presentedInput };
             }
@@ -902,7 +903,7 @@ export async function runToolGate(input) {
         }
         if (decision.action === "ask") {
             const askBeforeResolve = decision;
-            const resolved = await resolveAsk(decision, req);
+            const resolved = await (callSignal !== undefined ? resolveAsk(decision, req, callSignal) : resolveAsk(decision, req));
             if (resolved.action !== "ask" && resolved.approver !== undefined)
                 resolvedApprover = resolved.approver;
             if (resolved.action === "deny" && isAskDenyResolution(resolved.resolution))
@@ -978,7 +979,7 @@ export async function runToolGate(input) {
                     let recheck = { action: "allow" };
                     if (adjudicate) {
                         try {
-                            recheck = await adjudicate({ toolName, args: editArgs, toolCallId });
+                            recheck = await (callSignal !== undefined ? adjudicate({ toolName, args: editArgs, toolCallId }, callSignal) : adjudicate({ toolName, args: editArgs, toolCallId }));
                         }
                         catch (err) {
                             recheck = {
@@ -1014,7 +1015,9 @@ export async function runToolGate(input) {
                         editArgs = recheck.updatedInput;
                         editRewrittenSinceHuman = true;
                     }
-                    const rr = await resolveAsk({ ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) }, { toolName, args: editArgs, toolCallId });
+                    const editAskDecision = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
+                    const editAskReq = { toolName, args: editArgs, toolCallId };
+                    const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     resolvedApprover = rr.action !== "ask" ? rr.approver : undefined;
                     if (rr.action !== "allow") {
                         if (rr.action === "deny" && isAskDenyResolution(rr.resolution))

package/dist/core/image-downsample.d.ts

@@ -15,9 +15,10 @@
 export declare const MCP_IMAGE_MAX_BASE64: number;
 /**
  * 批③ image-pipeline — CC 2.1.x `constants/apiLimits.ts` values, shared by the MCP inline-image bound
- * AND the Read tool's image branch (tools/fs — internal consistency: ONE yardstick per limit). See also
- * `tools/fs/index.ts:40-41` ("one limit, two consumers, no drift") — the other consumer of this same
- * yardstick, which is where this invariant was originally called out.
+ * AND the Read tool's image branch (tools/fs — internal consistency: ONE yardstick per limit). That other
+ * consumers are the file tools (`tools/fs/fs-read.ts`'s image branch, plus `fs-pdf`/`fs-bash`), which IMPORT
+ * {@link MCP_IMAGE_MAX_BASE64} / {@link IMAGE_TARGET_RAW_SIZE} from here (through core/mcp.js's re-export)
+ * rather than re-deriving them — one limit, every consumer reading it, no drift.
  * - `IMAGE_TARGET_RAW_SIZE` (apiLimits.ts:29): raw-byte target that guarantees the base64 encoding stays
  *   under {@link MCP_IMAGE_MAX_BASE64} (raw × 4/3 = base64 → 3.75MB raw = 5MB base64).
  * - `IMAGE_MAX_WIDTH/HEIGHT` (apiLimits.ts:42-43): client-side resize box. The API internally resizes

package/dist/core/memory-engine/engine.d.ts

@@ -796,6 +796,27 @@ export declare function memoryConsolidationRefusedNotice(input: {
     reason?: string;
     occurrenceId?: string;
 }): EngineNotice;
+/**
+ * design/383 §S-7 (#511 件1) — {@link MemoryEngine.sessionMemoryStatus}'s answer. Every key is
+ * optional; ABSENCE means the fact's source could not be read (a fault never coins a `false`/`0`
+ * stand-in) — see the method doc for each key's exact absence law.
+ */
+export interface SessionMemoryStatus {
+    /** TRUE = a standing capture opt-out record; FALSE = store readable, no record (capture on).
+     *  ABSENT = the record store faulted — indeterminate (`optOutSource: "fault"` accompanies). */
+    captureOptedOut?: boolean;
+    /** Committed entries carrying this session's lineage contribution. Absent = ledger unreadable. */
+    committedCount?: number;
+    /** Of those, entries already folded into consolidation products (lineage × `distilled.inputs`).
+     *  Absent = ledger / scope enumeration / product read unreadable. */
+    foldedCount?: number;
+    /** WHY `captureOptedOut` reads as it does: `"record"` = a standing one-way record;
+     *  `"fault"` = the store faulted and the capture state is INDETERMINATE (no boolean is coined). */
+    optOutSource?: "record" | "fault";
+    /** Newest lineage `lastAt` for this session (ms epoch) — rides the same single ledger read as
+     *  `committedCount`. Absent = ledger unreadable, or no committed contribution exists at all. */
+    lastCaptureAt?: number;
+}
 export declare class MemoryEngine {
     private readonly backend;
     private readonly memoryDir;
@@ -910,13 +931,17 @@ export declare class MemoryEngine {
      * first cross-process resume, and "私密 only until the next resume" is a promise this engine
      * refuses to imply — the deliberate divergence from the pollution marker's best-effort arm.
      */
-    markSessionCaptureOptOut(sessionId: string, reason: string): SessionCaptureOptOutMarkOutcome;
+    markSessionCaptureOptOut(sessionId: string, reason: string): SessionCaptureOptOutMarkOutcome | Promise<SessionCaptureOptOutMarkOutcome>;
     /** The session's capture opt-out record (in-process first, then the durable store) — undefined =
      *  capture is on. Side-effect-free OBSERVER face; a THROWING store read degrades to the
      *  in-process answer here. Every consumer whose answer decides whether bytes COMMIT must use
      *  {@link sessionCaptureOptOutOrFault} instead — this face cannot distinguish "no record" from
-     *  "store outage", and on that distinction the fail direction flips. */
-    sessionCaptureOptOut(sessionId: string): SessionCaptureOptOutRecord | undefined;
+     *  "store outage", and on that distinction the fail direction flips.
+     *  DUAL FORM (#511 件2, the whole capture-face family — this one, `sessionCaptureOptOutOrFault`,
+     *  `markSessionCaptureOptOut`, `listCaptureOptOutSessions`): over a sync store the answer is the
+     *  same synchronous value as always; over a Promise-form {@link SessionCaptureRecordStore} the
+     *  face answers a Promise of the identical shape. `await` is always correct on either arm. */
+    sessionCaptureOptOut(sessionId: string): SessionCaptureOptOutRecord | undefined | Promise<SessionCaptureOptOutRecord | undefined>;
     /** {@link sessionCaptureOptOut} with the FAULT axis preserved (codex review, 亲核 adopted):
      *  `fault: true` ⇔ the durable store THREW — the record state is INDETERMINATE, which the
      *  commit-deciding consumers (harvest opening read, pre-commit re-read, the runner's read
@@ -926,11 +951,14 @@ export declare class MemoryEngine {
     sessionCaptureOptOutOrFault(sessionId: string): {
         record?: SessionCaptureOptOutRecord;
         fault: boolean;
-    };
+    } | Promise<{
+        record?: SessionCaptureOptOutRecord;
+        fault: boolean;
+    }>;
     /** Every capture-opted-out session id (durable roster ∪ in-process marks). THROWS on an
      *  enumeration failure — the one consumer (the consolidation eligibility arm, §2.4) is
      *  fail-closed by design: "roster unknown" must refuse the run, never read as "no one opted out". */
-    listCaptureOptOutSessions(): Set<string>;
+    listCaptureOptOutSessions(): Set<string> | Promise<Set<string>>;
     /**
      * design/383 §2.3 — the mid-session flip's BOUNDARY-ISOLATION SWEEP over the write plane: files
      * under the writable root that this session window added or changed (vs the materialize baseline)
@@ -1445,6 +1473,35 @@ export declare class MemoryEngine {
      * registry THROWS fail-closed — the same reason an unsupported one never reads as empty.
      */
     listMemoryScopes(): Promise<MemoryScopeEnumeration>;
+    /**
+     * design/383 §S-7 (#511 件1) — the HOST's per-session memory-status read face: the data supply
+     * for the "memory capture is off / N committed, M folded" disclosure family and the
+     * resume-visibility answer (state face, not event face — notice dedup semantics are untouched).
+     * A server projects it onto a wire endpoint as a PURE derivation of these keys.
+     *
+     * EVERY key is optional and its ABSENCE means "that fact's source could not be read" — a fault
+     * never coins a `false`/`0` stand-in (the §3.1 fault-transit law):
+     *  - `captureOptedOut` — the capture opt-out state. Present `true` (a standing record — with
+     *    `optOutSource: "record"`) or present `false` (the store answered and no one-way record
+     *    exists — genuine "capture on"). ABSENT ⇔ the record store faulted: the capture state is
+     *    INDETERMINATE and `optOutSource: "fault"` says so (the 383 片2/3 `captureIndeterminate`
+     *    axis, projected — never a boolean).
+     *  - `committedCount` — how many committed entries carry this session's lineage contribution
+     *    (the lineage ledger's committed set). Absent ⇔ the ledger is unreadable.
+     *  - `foldedCount` — of those, how many appear among the `distilled.inputs` of committed
+     *    consolidation products (the lineage × distilled.inputs intersection — "already folded into
+     *    long-term memory"). Absent ⇔ the ledger, the scope enumeration (a backend without
+     *    `listScopes` cannot name the header universe), or the product read is unreadable.
+     *  - `lastCaptureAt` — the newest `lastAt` over this session's lineage contributions (ms epoch).
+     *    CHEAP by construction — it rides the SAME single ledger read as `committedCount`, so it is
+     *    carried rather than dropped; absent ⇔ the ledger is unreadable OR the session has no
+     *    committed contribution at all (there is no such moment to name — the one key whose absence
+     *    also covers "no fact exists", stated here so consumers need not guess).
+     *
+     * Side-effect-free committed reads throughout (capture face + lineage sidecar + audit-face
+     * headers/getByIds); never throws — an unreadable source is an absent key, which IS the answer.
+     */
+    sessionMemoryStatus(sessionId: string): Promise<SessionMemoryStatus>;
     /** The committed, side-effect-free audit read: the adoption-restricted committed view when the
      *  backend offers one (zero-copy File — ledger+shadow, no disk adoption), else the non-adopting
      *  retrieval view (copy-out File), else the backend itself (Pg/TiDB shapes — naturally committed